feat: add the optional Antigravity runtime core - #74
Conversation
|
Warning Review limit reached
Next review available in: 33 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Summary by CodeRabbit
WalkthroughAdds a complete Antigravity runtime lifecycle. The changes provide installation and update commands, verified executable activation, runtime launching, persistent-state hardening, fixture-based regression tests, and GitHub Actions automation. ChangesAntigravity runtime
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant Developer
participant GitHubActions
participant RuntimeTest
participant AntigravityCLI
participant AntigravityBinary
Developer->>GitHubActions: open pull request or dispatch workflow
GitHubActions->>RuntimeTest: validate scripts and run fixture lifecycle
RuntimeTest->>AntigravityCLI: install or update approved fixture
AntigravityCLI-->>RuntimeTest: report status and executable path
RuntimeTest->>AntigravityBinary: launch with preserved arguments
AntigravityBinary-->>RuntimeTest: return configured exit status
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7629d333bc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 14
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/remote-dev-antigravity.sh`:
- Around line 271-289: Bound both vendor-supplied executions and make them
non-interactive: in scripts/remote-dev-antigravity.sh lines 271-289, update
run_installer_isolated to invoke the installer through timeout 900s and redirect
stdin from /dev/null; in lines 162-182, update run_binary_no_update to invoke
the candidate through timeout 30s and redirect stdin from /dev/null. Also add
timeout to the require_tools list around lines 109.
- Around line 360-363: Update the staged executable permission in the
installation flow around verify_file_identity and chmod to use mode 0700 instead
of 0755, matching the final installed mode while preserving the surrounding
validation and manifest-writing steps.
- Around line 10-16: Update the cleanup trap in cleanup to handle INT and TERM
as well as EXIT, ensuring interruptions during download or installation remove
cleanup_root under the same guarded removal logic.
- Around line 70-79: Update reject_symlink_components so the ancestor walk
detects when dirname no longer changes current and exits the loop, while
preserving the existing root termination and symlink rejection behavior. Ensure
paths such as //srv/state cannot cause an infinite loop when dirname returns the
same value.
- Around line 367-372: Update the replacement flow around the final_new and
manifest_new renames to move the manifest before the binary, and make the
mismatch/error paths in read_current_installation (including the Line 197 and
Line 210 cases) explicitly instruct users to remove both $binary and $manifest,
then run remote-dev-install-antigravity. Ensure the actionable recovery guidance
appears for the SHA mismatch and manifest identity failure scenarios.
- Around line 116-117: Update the jq validation at the evidence gate to
explicitly require .schema_version to be a number before applying the >= 2
comparison, while preserving the exact empty-array check for .blocking_findings.
Do not change the manifest gate’s existing .schema_version == 1 comparison.
- Around line 252-264: Update the curl invocation that downloads from
OFFICIAL_INSTALLER_URL to explicitly restrict redirected requests to HTTPS using
the appropriate redirect-protocol option, matching the existing --proto '=https'
constraint. Keep the current retry, timeout, and output behavior unchanged.
- Around line 61-65: Extend the broad-path case list in the path validation
logic to reject /home, /opt, /usr, /usr/local, /etc, /var, and
/root/.local/share alongside the existing entries. Keep these values routed
through fail with the existing label and message behavior.
In `@scripts/run-antigravity.sh`:
- Around line 28-30: Update the status gate in the launcher around the manager
status invocation to capture its stdout and, when the command rejects the
launch, print that captured reason along with the recovery guidance before
preserving the nonzero exit status. Keep successful status checks silent and
retain the existing set -euo pipefail behavior.
- Around line 32-36: Harden the WORKSPACE validation before the mkdir and cd
flow: reject parent-directory components and broad root targets, and reject
symlinked path components using the same policy as require_absolute_safe_path
and reject_symlink_components in the remote-dev launcher. Alternatively, require
WORKSPACE to already exist so this script never creates an untrusted path, while
preserving the existing absolute-path and newline checks.
- Around line 40-48: Install an EXIT trap in the launcher that invokes the
existing secure_state hardening command whenever the script terminates,
including signal-driven exits. Ensure the trap preserves the captured
session_status and avoids running the hardening step twice on the normal path by
consolidating cleanup and final exit behavior around session_status.
In `@scripts/secure-persistent-state.sh`:
- Around line 79-87: Wrap the Antigravity hardening block identified by
secure_dir "$antigravity_bin_dir" and the subsequent secure_tree calls in a
REMOTE_DEV_ROLE == antigravity condition. Ensure Codex and Shell startup skip
all Antigravity directory, file, and vendor-tree inspection while preserving the
existing hardening behavior for the antigravity role.
- Around line 19-27: Centralize the Antigravity path defaults currently
duplicated in the secure-state setup and the runtime manager: add a root-owned,
read-only scripts/antigravity-paths.sh containing the three path assignments,
then have both scripts/secure-persistent-state.sh and
scripts/remote-dev-antigravity.sh read those shared values instead of defining
local literals. Keep the REMOTE_DEV_ANTIGRAVITY_TESTING overrides and
required-variable validation in secure-persistent-state.sh, and ensure the
shared file is not sourced from user-writable state.
In `@scripts/test-antigravity-runtime.sh`:
- Around line 232-273: Extract the repeated failure-test boilerplate from the
four installer scenarios into a helper such as assert_install_rejects, accepting
setup and assertion callbacks. Keep fixture creation, evidence mismatches, and
scenario-specific assertions in the callbacks, while the helper handles
reset_runtime, exporting REMOTE_DEV_ANTIGRAVITY_INSTALLER_FIXTURE, running the
expected-failure install, and invoking the assertion.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 816bc913-dd80-4730-bd58-6383fe2f4845
📒 Files selected for processing (7)
.github/workflows/test-antigravity-runtime.ymlscripts/remote-dev-antigravity.shscripts/remote-dev-install-antigravity.shscripts/remote-dev-update-antigravity.shscripts/run-antigravity.shscripts/secure-persistent-state.shscripts/test-antigravity-runtime.sh
📜 Review details
🧰 Additional context used
📓 Path-based instructions (7)
**/*.{yml,yaml,Dockerfile,sh,bash,js,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{yml,yaml,Dockerfile,sh,bash,js,ts,tsx}: Never use privileged containers, Docker or Podman sockets, SYS_ADMIN, host-root mounts, or broad persistence mounts such as /root, /home, /opt, /usr/local, or a parent data root.
Preserve mandatory ttyd authentication for agent terminals, origin checking for all web endpoints, tmux reconnect behavior, image identity checks, and existing Codex login, start, and resume behavior.
Files:
scripts/remote-dev-update-antigravity.shscripts/remote-dev-install-antigravity.shscripts/test-antigravity-runtime.shscripts/secure-persistent-state.shscripts/run-antigravity.shscripts/remote-dev-antigravity.sh
**/*.{sh,bash,js,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Never use eval, sourced editable state, or user-controlled shell fragments for role, mode, installer, routing, or command dispatch.
Files:
scripts/remote-dev-update-antigravity.shscripts/remote-dev-install-antigravity.shscripts/test-antigravity-runtime.shscripts/secure-persistent-state.shscripts/run-antigravity.shscripts/remote-dev-antigravity.sh
**/*.{sh,bash}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{sh,bash}: Use fixed, validated enums for roles and start modes; reject unknown values with a deterministic non-zero exit status and a clear message.
Build command invocations with Bash arrays, preserve arguments without re-evaluating them, preserve command exit status, and run persistent-state hardening after supported interactive sessions.
Files:
scripts/remote-dev-update-antigravity.shscripts/remote-dev-install-antigravity.shscripts/test-antigravity-runtime.shscripts/secure-persistent-state.shscripts/run-antigravity.shscripts/remote-dev-antigravity.sh
**/*.{yml,yaml,sh,bash}
📄 CodeRabbit inference engine (AGENTS.md)
Implement issue
#25in separately reviewed slices: role-neutral commands and validation, configurable Codex approval modes, canonical image and variable naming with time-bounded aliases, shared image digest, Compose and state migration, and outer hardening with cross-service canaries.
Files:
scripts/remote-dev-update-antigravity.shscripts/remote-dev-install-antigravity.shscripts/test-antigravity-runtime.shscripts/secure-persistent-state.shscripts/run-antigravity.shscripts/remote-dev-antigravity.sh
**/*.{sh,bash,js,ts,tsx,yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
Run the narrowest relevant tests during development and complete required CI before merge; preserve or extend coverage for role/start-mode validation, wrappers, launcher security, mounts, image identity, health checks, Codex flows, credential hardening, ttyd, tmux, provenance, notices, SBOM, Trivy, and the critical-vulnerability gate.
Files:
scripts/remote-dev-update-antigravity.shscripts/remote-dev-install-antigravity.shscripts/test-antigravity-runtime.shscripts/secure-persistent-state.shscripts/run-antigravity.shscripts/remote-dev-antigravity.sh
scripts/**/*.sh
⚙️ CodeRabbit configuration file
scripts/**/*.sh: Review as production Bash. Check quoting, set -euo pipefail behavior, cleanup traps,
bounded retries and timeouts, non-interactive execution, idempotency and useful failure messages.
Flag commands that can hang, leak credentials, silently ignore failures or mutate persistent data unexpectedly.
Files:
scripts/remote-dev-update-antigravity.shscripts/remote-dev-install-antigravity.shscripts/test-antigravity-runtime.shscripts/secure-persistent-state.shscripts/run-antigravity.shscripts/remote-dev-antigravity.sh
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Review GitHub Actions for least-privilege permissions, safe event triggers, untrusted input handling,
accidental publication, tag-channel correctness, secret exposure, reproducible builds, SBOM/provenance
generation and appropriate validation before pushing images.
Files:
.github/workflows/test-antigravity-runtime.yml
🪛 ast-grep (0.45.0)
scripts/test-antigravity-runtime.sh
[warning] 197-197: set +e (or set +o errexit) disables the shell's errexit option, so the script keeps running after a command fails. This masks failures of security-critical operations (downloads, signature/checksum verification, permission changes, cleanup of secrets), letting the script proceed with a bad or insecure state. Leave errexit enabled (set -e / set -euo pipefail), or handle failures explicitly with if/|| and an explicit exit instead of globally turning off failure detection.
Context: set +e
Note: [CWE-754] Improper Check for Unusual or Exceptional Conditions.
(set-plus-e-error-masking-bash)
🪛 Shellcheck (0.11.0)
scripts/test-antigravity-runtime.sh
[info] 74-74: Expressions don't expand in single quotes, use double quotes for that.
(SC2016)
scripts/remote-dev-antigravity.sh
[warning] 354-354: When used with -p, -m only applies to the deepest directory.
(SC2174)
🔇 Additional comments (15)
scripts/remote-dev-antigravity.sh (5)
81-112: LGTM!
136-160: LGTM!
184-212: LGTM!
214-245: LGTM!
383-412: LGTM!Also applies to: 414-443
scripts/remote-dev-install-antigravity.sh (1)
1-3: LGTM!scripts/remote-dev-update-antigravity.sh (1)
1-3: LGTM!scripts/run-antigravity.sh (2)
4-16: LGTM!
43-46: 🎯 Functional CorrectnessNo change needed.
secure-persistent-state.shusesREMOTE_DEV_ROLEas the role input andREMOTE_DEV_ROLEis already exported byrun-antigravity.sh, so the no-argument invocation is valid.> Likely an incorrect or invalid review comment.scripts/secure-persistent-state.sh (2)
6-6: LGTM!
43-54: LGTM!scripts/test-antigravity-runtime.sh (2)
1-159: LGTM!Also applies to: 168-231
161-166: 🩺 Stability & AvailabilityNo change needed.
A declined confirmation exits 0, so the
set -eguard does not terminate the test prematurely..github/workflows/test-antigravity-runtime.yml (2)
1-21: LGTM!Also applies to: 29-42
6-9: 📐 Maintainability & Code QualityWrap coverage concern is satisfied.
scripts/remote-dev-install-antigravity.shandscripts/remote-dev-update-antigravity.share thin dispatch wrappers that only prependinstall/update, thenexecthe manager with forwarded arguments, so the existing syntax check covers them.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aa07037aea
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the current head after the runtime hardening and recoverability fixes. Focus on installer/payload trust gates, signal handling, publication recovery, path validation, disclosures and absence of implicit downloads. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6adfaad4d5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| trap 'forward_signal INT 130' INT | ||
| trap 'forward_signal TERM 143' TERM | ||
|
|
||
| "$binary" "$@" & |
There was a problem hiding this comment.
In normal use this non-interactive Bash script has job control disabled, so Bash redirects an asynchronous command's standard input from /dev/null unless an explicit redirection is supplied. Launching agy with & therefore makes login prompts and interactive agent sessions receive EOF rather than terminal input, even though their output remains visible; explicitly preserve fd 0 when backgrounding or use a foreground signal-aware arrangement.
AGENTS.md reference: AGENTS.md:L54-L54
Useful? React with 👍 / 👎.
| trap 'forward_signal INT 130' INT | ||
| trap 'forward_signal TERM 143' TERM | ||
|
|
||
| "$binary" "$@" & |
There was a problem hiding this comment.
When a user presses Ctrl-C in an Antigravity terminal, asynchronous commands started with job control disabled inherit SIGINT as ignored. Fresh evidence in the final head is this new background launch: the parent trap forwards INT, but agy ignores it and forward_signal then blocks in wait, preventing both session termination and the EXIT hardening path. Reset the child's SIGINT disposition before execing it.
AGENTS.md reference: AGENTS.md:L54-L54
Useful? React with 👍 / 👎.
|
@codex review Final pass on current head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6adfaad4d5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| local old_sha old_size old_version | ||
| old_sha="$(jq -er '.binary_sha256' "$manifest")" | ||
| old_size="$(jq -er '.binary_size' "$manifest")" | ||
| old_version="$(jq -er '.version' "$manifest")" |
There was a problem hiding this comment.
When an existing installation no longer matches the current bundled evidence, this code treats fields from the locally writable install.json as trust anchors. A compromised or tampered agy process can replace both its executable and manifest with matching attacker-chosen hash, size, and version values; read_current_installation then accepts them and executes the replacement via read_version_with_identity during every status, launch, or update, bypassing the intended executable identity check. Validate legacy versions against immutable bundled historical evidence, or avoid executing any binary that does not match such evidence.
Useful? React with 👍 / 👎.
1 participant
Progresses #27.
Scope
This PR adds the auditable runtime core only. It deliberately does not copy the commands into the image or wire Antigravity into the menu, role dispatcher, diagnostics, persistence mounts or TrueNAS deployment yet.
remote-dev-antigravity install|update|status|pathrun-antigravity--yesbefore any download--yesflowsagysize, SHA-256 and version before invoking or publishing itEXITtrap, including interrupted sessionsProduction Antigravity-specific credential/state hardening is intentionally deferred to the role-integration PR so Codex and Shell behavior remains unchanged in this slice.
Offline regression coverage
The dedicated workflow uses generated fixtures only and validates:
agy --versionValidation
Next slice
After this core passes final review, a separate PR will copy the commands into the image and add the Antigravity role, tmux/direct mode, menu actions, diagnostics, shared root-owned path definitions, role-specific state hardening, persistence mounts and the TrueNAS validation plan.